Subject: 2. Uselessness of C/R RE: [Asrg] Its all over for Challenge Respo nse

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 28 Jan 2004 08:32:59 -0800

>We have seen this mentioned here before. This approach to C/R by spammers 
>does have one beneficial side-effect: they must ensure that the challenge 
>gets back to a useful address. Thus, they can no longer forge everything
and 
>expect mail to get through.

The same effect can be achieved without negative impact on the end user 
experience.

It is possible to save the turing test mechanism, but not for private
practices. I just sent this out to the managers responsible for the Turing
test mechanisms used to stop mass signups for mail accounts. Basically
Microsoft should add a copyright notice to their turing test image and offer
a free X-Box for the first person to report each site using a man in the
middle attack to defeat it.

Problem:	Spammers pay people to solve Turing tests with pornography
		Attack reported in high visibility forum (Slashdot)

Risk:		Loss of confidence in anti-spam measures, 
		Very high probability of press attention, MUST have prompt
response
		Public MUST NOT believe spammers have upper hand.

Solution:	Add copyright notice to Turing test and sue malefactors.

Reference:
	
http://yro.slashdot.org/article.pl?sid=04/01/28/1344207&mode=flat&tid=111&ti
d=126&tid=172&tid=95&threshold=1

Background:

	Turing tests are widely used to limit signups for free email
accounts (hotmail, Yahoo!). In addition they are used in some of the more
unpleasant email C/R schemes. 

	A typical turing test consists of a GIF image that has been
distorted in some way that is difficult to reverse using OCR techniques but
is easy for a human viewer to read.

	The problem here is that the turing test is subject to a form of man
in the middle attack. The viewer of one site is tricked (or bribed) into
solving the Turing test of another site. Pornography provides an incentive
that is free to the spammer and attracts a large number of willing
participants.

Solution:

	A quick fix would be to add a copyright tag into the Turing test so
that it is clear that this substitution is taking place. 

	Set up a bounty system for reporting such attacks, a free X-Box is
probably more attractive than free porn. Or you could give a free X-Box and
a subscription to your choice of Penthouse, Comopolitan or a non-porn title.

	It is important that the press is quickly informed that there is a
response if public confidence is to be maintained. For anti-spam measures to
be effective as psychology, it is vital that people believe that it is the
spammers who are on the defensive.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Eric Dean" <[email-masked]>
Date: Wed, 28 Jan 2004 12:38:17 -0500

In fact, this is all an argument for CRI...one that does not involve
humans.

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 28 Jan 2004 12:53:56 -0500

> The same effect can be achieved without negative impact on the end user 

Beside regular C/R without Turing tests, I am not aware of something 
that can do the same thing without changing something in the underlying 
email architechture. The whole advantage of C/R is that it does not 
require anything to be changed, but annoys end-users. If you can list 
some other alternatives that can verify the return address, that would 
be helpful.

Also, like Eric Dean mentioned, if the whole purpose of C/R is to verify 
return addresses, adding an automated proposal like CRI would help 
reduce the end-user problems, ASSUMING that return address verification 
is useful at all.

(Just a note, I am not advocating C/R, just engaging in a discussion 
about it)

Yakov
-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"All that is gold does not glitter" (LOTR)
-------

---

From: Paul Tenny <[email-masked]>
Date: Wed, 28 Jan 2004 18:00:16 -0500

> 		Attack reported in high visibility forum (Slashdot)

The same flaw applies to just about everything. If you have the money, 
you can beat just about anything.

> 		Public MUST NOT believe spammers have upper hand.

Based on what I've read on this list and the technology available now 
as well as the total lack of interest in "doing what it takes" to get 
results, I have about the least amount of confidence possible in 
anti-spam measures. Tricking the public into thinking what YOU want 
them to think versus the truth as it stands today (they have always 
had the upper hand) is just stalling. Always tell the truth, it's the 
best policy.

> Solution:	Add copyright notice to Turing test and sue malefactors.

Yes, because we all know how well copyright protects everything else
in the digital realm, like music and movies.

> that is free to the spammer and attracts a large number of willing

The real problem here is that like all C/R these things are nothing 
but stopgap measures, not solutions.

[Please don't CC responses to me, I'm subscribed here.]